{"id":101609,"date":"2021-10-12T16:23:09","date_gmt":"2021-10-12T14:23:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-libreoffice-i-apache-openoffice-pozvolyayushhie-obojti-proverku-czifrovoj-podpisi"},"modified":"2021-10-12T16:23:09","modified_gmt":"2021-10-12T14:23:09","slug":"uyazvimosti-v-libreoffice-i-apache-openoffice-pozvolyayushhie-obojti-proverku-czifrovoj-podpisi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-libreoffice-i-apache-openoffice-pozvolyayushhie-obojti-proverku-czifrovoj-podpisi","title":{"rendered":"Vulnerabilities in LibreOffice and Apache OpenOffice Allowing Bypass of Digital Signature Verification","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Details have been revealed about three vulnerabilities in the office suites LibreOffice and Apache OpenOffice that allow attackers to prepare documents that appear to be signed by a trusted source or alter the date of an already signed document. The issues were addressed in the releases Apache OpenOffice 4.1.11 and LibreOffice 7.0.6\/7.1.2 under the guise of non-security-related bugs (the LibreOffice 7.0.6 and 7.1.2 releases were published in early May, but information about the vulnerability was disclosed only now). <\/p>\n
\n
CVE-2021-41832, CVE-2021-25635 \u2014 allows an attacker to sign an untrusted ODF document with a self-signed certificate by altering the digital signature algorithm to an incorrect or unsupported value, making the document appear trusted (the signature with an incorrect algorithm was processed as valid).\n
CVE-2021-41830, CVE-2021-25633 \u2014 allows an attacker to create an ODF document or macro that will appear trusted in the interface by combining data signed with different certificates in the documentsignatures.xml and macrosignatures.xml files, despite the presence of additional content certified by another certificate.\n
CVE-2021-41831, CVE-2021-25634 \u2014 allows modifications to a signed ODF document's digital signature that distort the displayed timestamp of the digital signature without violating trust indications. <\/ul>\n